diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 62d85ff..ba1d495 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -163,7 +163,7 @@
     uint64_t daif; /* exception masks, in the bits they are in in PSTATE */
 
     uint64_t elr_el[2]; /* AArch64 exception link regs  */
-    uint64_t sp_el[2]; /* AArch64 banked stack pointers */
+    uint64_t sp_el[4]; /* AArch64 banked stack pointers */
 
     /* System control coprocessor (cp15) */
     struct {
diff --git a/target-arm/machine.c b/target-arm/machine.c
index b0fa46d..7b18a90 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -218,8 +218,8 @@
 
 const VMStateDescription vmstate_arm_cpu = {
     .name = "cpu",
-    .version_id = 17,
-    .minimum_version_id = 17,
+    .version_id = 18,
+    .minimum_version_id = 18,
     .pre_save = cpu_pre_save,
     .post_load = cpu_post_load,
     .fields = (VMStateField[]) {
@@ -239,7 +239,7 @@
         VMSTATE_UINT32_ARRAY(env.usr_regs, ARMCPU, 5),
         VMSTATE_UINT32_ARRAY(env.fiq_regs, ARMCPU, 5),
         VMSTATE_UINT64(env.elr_el[1], ARMCPU),
-        VMSTATE_UINT64_ARRAY(env.sp_el, ARMCPU, 2),
+        VMSTATE_UINT64_ARRAY(env.sp_el, ARMCPU, 4),
         /* The length-check must come before the arrays to avoid
          * incoming data possibly overflowing the array.
          */